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1. A method for classifying by means of a computing 
system, connections detected between senders and 
5 receivers in communication networks which use 

protocols, each named by a usable protocol name, 
characterized in that in the computing system: 

- associated with each usable protocol name is' a 
protocol self identifier mechanism devised so as 

10 to recognize determinant information of the 

protocol named by this name, from among 
information conveyed in a detected connection, 

- associated with each so-called father protocol 
usable protocol name is a non empty or empty 

15 list of so-called son protocol usable protocol 

names , 

- with each connection detected, a computing 
kernel associates (1002, 1003) a first data 
structure devised so as to contain an ordered 

2 0 sequence of used protocol names which is 

initialized with a so-called base protocol name, 

- for each connection detected, the computing 
kernel constructs (1004) the first data 
structure by searching (2000) through the list 

25 of son protocol names, associated with the last 

name of said ordered sequence, for a son 
protocol name for which the associated 
self identifier mechanism recognizes (2002, 2007) 
determinant information from among the 

30 information conveyed and then by appending 

(2 003) to the end of the ordered sequence, the 
son protocol name when it is found and by 
starting to search again so long as it is 
possible to find (2009) in the list of son 

35 protocol names, associated with the last name of 

said ordered sequence, a son protocol name for 
which the associated self identifier mechanism 
recognizes determinant information from among 
the information conveyed, 
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- the computing kernel declares (2010) classified 
the connection detected when it is no longer 
possible to find in the list of son protocol 
names, associated with the last name of said 
5 ordered sequence, a son protocol name for which 

the associated self identifier mechanism 
recognizes determinant information from among 
the information conveyed. 



10 2. The method for classifying connections as claimed 
in claim 1, characterized in that to search for a 
son protocol name, the computing kernel submits 
(2 006) the information conveyed, to each 
self identifier mechanism associated with a name 

15 from the list of son protocol names until one of 

the self identifier mechanisms declares (2007) 
recognition of determinant information or until no 
self identifier mechanism can declare recognition 
(2 012) of determinant information . 

20 

3. The method for classifying connections as claimed 
in claim 1, characterized in that to search for a 
son protocol name, the computing kernel submits 
(2 002) the information conveyed to the 

25 self identifier mechanism associated with the last 

name of the ordered sequence, in such a way that 
this self identifier mechanism finds the name of 
the son protocol among the determinant information 
of the father protocol . 

30 

4. The method for classifying connections as claimed 
in one of the preceding claims, characterized in 
that the computing kernel formulates (1001) a 
current signature for each connection detected, by 

3 5 submitting all or part of the information conveyed 

to at least one self identifier mechanism 
associated with one of the names of low rank in 
said ordered sequence, in such a way that this 
self identifier mechanism finds among the 
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determinant inf ormation, source and destination 
indicators incorporated into said current 
signature by the computing kernel. 

5 5. The method for classifying connections as claimed 
in claim 4, characterized in that the computing 
kernel catalogs each first data structure in a 
first table (1) by establishing a first 
associative correspondence between each first data 
10 structure and the current signature formulated 

(1001) for the associated connection. 

6. The method for classifying connections as claimed 
in claim 5, characterized in that the computing 

15 kernel establishes (1003, 2011) in said first 

table (1) a. second associative correspondence 
between each current signature and a peer 
signature whose source indicators are the 
indicators of destination of the current signature 

20 and whose destination indicators are the 

indicators of source of the current signature. 

7 . The method for classifying connections as claimed 
in one of claims 5 and 6, characterized in that: 

25 - the computing kernel gathers (1000) in data 

packets passing through the computing system 
within connections to be detected, the useful 
information conveyed so as to formulate a 
signature in such a way as to formulate (1001) 

30 the current signature whenever the useful 

information conveyed is sufficient, 
- the computing kernel uses the current signature 
thus formulated in real time to detect a 
connection, in such a way as to search (1002) in 

35 said first table (1) , for the first data 

structure which corresponds to the current 
signature, to associate (1003) a new first data 
structure with the connection detected when 
there exists no first data structure which 
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corresponds to the current signature and to 
start or continue (2 000) to construct the first 
data structure when there exists a first data 
structure which corresponds (1002) to the 
5 current signature, by gathering (1000) in the 

data packets, the useful information conveyed so 
as to construct first data structure. 

8. The method for classifying connections as claimed 
10 in claim 7, characterized in that, when the useful 

information gathered in a data packet is not 
sufficient to formulate a signature, the computing 
kernel catalogs the useful information in a second 
table by establishing an associative 

15 correspondence between the useful information 

which then comprises links of membership to one 
and the same connection, until the useful 
information is sufficient to formulate the current 
signature . 

20 

9. The method for classifying connections as claimed 
in one of the preceding claims, characterized in 
that: 

- the computing, kernel traverses (1006) the used 
25 protocol names of the ordered sequence in the 

data structure which it constructs so as to 
detect (1007) each dynamic connection protocol 
name, 

- for each dynamic connection protocol name 
3 0 detected, the computing kernel submits (1008) 

the information conveyed to the self identifier 
mechanism associated with the name detected in 
such a way as to determine whether there exists 
a subsequent dynamic connection and if a 
35 subsequent connection exists, to . associate 

therewith (1009) a second data structure devised 
so as to contain an ordered sequence of 
potential protocol names which begins with the 
so-called base protocol name. 
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10. The method for classifying connections as claimed 
in claims 5 and 9, characterized in that the 
computing kernel catalogs (1009) each second data 
structure in a second table (2) by establishing an 
associative correspondence between each second 
data structure and a potential signature 
formulated by the self identifier mechanism 
associated with the name detected. 



11. The method for classifying connections as claimed 
in claim 10, characterized in that the computing 
kernel furthermore constructs the first data 
structure : 

- by searching (2 004) for the ordered sequences of 
potential protocol names in which the ordered 
sequence of used protocol names is included and, 

- when there exists (2 005) an ordered sequence of 
potential protocol names whose potential 
signature corresponds to the current signature, 
by completing (2 003) the first data structure by 
means of the second data structure. 



